apiVersion: apps/v1
kind: Deployment
metadata:
  name: kubelatte-ce
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: kubelatte-ce
  template:
    metadata:
      labels:
        app.kubernetes.io/name: kubelatte-ce
    spec:
      restartPolicy: {{ .Values.restartPolicy }}
      serviceAccountName: {{ .Values.serviceAccount.name }}
      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
      {{- if .Values.podSecurityContext.enabled }}
      securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
      {{- end }}
      imagePullSecrets:
        {{- range .Values.image.pullSecrets }}
        - name: {{ . }}
        {{- end }}
      containers:
        - name: kubelatte
          {{- if .Values.podSecurityContext.enabled }}
          securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
          {{- end }}
          image: {{ printf "%s/%s:%s" .Values.image.registry .Values.image.repository .Values.image.tag }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          args:
            - '--health-probe-bind-address=:8081'
            - '--metrics-bind-address=127.0.0.1:8080'
            - '--leader-elect'
          env:
            - name: KUBERNETES_SERVICE_HOST
              value: kubernetes.default.svc.cluster.local
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
          envFrom:
            - configMapRef:
                name: kubelatte-ce-env
          {{- if .Values.livenessProbe.enabled }}
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
              scheme: HTTP
            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
            timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
            successThreshold: {{ .Values.livenessProbe.successThreshold }}
            failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
          {{- end }}
          ports:
            - containerPort: 8443
              name: https-8443
              protocol: TCP
          {{- if .Values.readinessProbe.enabled }}
          readinessProbe:
            httpGet:
              path: /readyz
              port: 8081
              scheme: HTTP
            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
            timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
            successThreshold: {{ .Values.readinessProbe.successThreshold }}
            failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
          {{- end }}

          resources:
            {{ toYaml .Values.resources | nindent 12 }}
          volumeMounts:
            - name: kubelatte-dir
              mountPath: /var/kubelatte
            - name: webhook-certs
              readOnly: true
              mountPath: /var/webhook/certs
      volumes:
        - name: kubelatte-dir
          emptyDir:
            sizeLimit: 500Mi
        - name: webhook-certs
          secret:
            secretName: webhook-cert
            defaultMode: 256
